thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Control Family

Grouping of related controls in a catalog such as NIST SP 800-53, identified by a two-letter code.

Definition

SP 800-53 Rev. 5 families are AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, and SR. Families organize controls by topic; they do not imply control type. NIST SP 800-171 uses 14 (Rev. 2) or 17 (Rev. 3) requirement families derived from them.

Example

IR-4 Incident Handling belongs to the Incident Response family.

Exam tip

Know a few family codes, such as CP for Contingency Planning and PM for Program Management.

Related terms